CVE-2026-82186: WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

Q: Who can exploit this issue?

An attacker needs administrator privileges in WordPress. This is not described as exploitable by unauthenticated users or lower-privileged accounts.

Q: Which installations are affected?

WPLP Cookie Consent versions earlier than 4.4.2 are affected. Updating the plugin to version 4.4.2 or later addresses the affected version range.

Q: What input is involved in the injection?

The issue involves an offset pagination parameter that is not properly validated before being incorporated into a SQL query.

Published Sep 4, 2026

Updated

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

Affected Software

1 affected component

WordPress plugin WPLP Cookie Consent<4.4.2

Event History

Sep 4, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs administrator privileges in WordPress. This is not described as exploitable by unauthenticated users or lower-privileged accounts.

Which installations are affected?

WPLP Cookie Consent versions earlier than 4.4.2 are affected. Updating the plugin to version 4.4.2 or later addresses the affected version range.

What input is involved in the injection?

The issue involves an offset pagination parameter that is not properly validated before being incorporated into a SQL query.